So from my home computer, using Firefox, I was on co.com, looking at the lie-flat stuff and route maps. At some point I went to the "home" page, and found I was logged in as someone (I have an account, but hadn't logged in). I've never heard of this person, but I could see his mileage balance and upcoming reservations(!). I was able to log-out of his account.

I did a search on this forum for that person's name, to see if it was some generic "fake" account, but found no hits at all.

Hard to believe that by just poking around on the website I could inadvertently be logged into someone's onepass account!